ce9f06f11a88f99e70c9f7de6e8fe48cf3302fdad45eb8c44a23aad32cb97674

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/08/2026, 06:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_e000207d72991bd518bc4c82520656c2_elex_glassworm_icedid_njrat_vidar.exe
Size 13.6MB
Sample260816-g2w2passfz
SHA256 ce9f06f11a88f99e70c9f7de6e8fe48cf3302fdad45eb8c44a23aad32cb97674
MD5 e000207d72991bd518bc4c82520656c2
SHA1 49c09a41ae909039e8773ed221cc84b9de6b1d61
SHA512 95d284ae299245dca476e1c8486e13dd880907f12f50b45e7edfea56c5f27e3fde04fcaef3bafbf4ef916a93f9c72f24b8d104fb91d9bd09d4b46dd0fe269e2e
SSDEEP 98304:teee6KRuy5a4eee6KRuy5aZ1MbQ9yDAD7KjjqkusjmqMhs:RqNqW1tIDewjqkjiqMS
TLSH
T19CE69E29E6E540F5F9BB9434896BC276E97279210632878FC6D0C63EAF336815D38731
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4744	svchost_AACBBAABBBCCAACCBCAABAAACABBCBBBACCCBBCCBABCBACBBCCCCBB.exe
4000	svchost_CBBCCBBCBAACACCCBBACBBACAACCCCAABCAABCABCAABCBABBABBCAA.exe
624	svchost_AACBBAABBBCCAACCBCAABAAACABBCBBBACCCBBCCBABCBACBBCCCCBB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_AACCACAACAABBACCAAACCABBAAAACABAAAACCBBABBBBBBBACACCACBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AACBBAABBBCCAACCBCAABAAACABBCBBBACCCBBCCBABCBACBBCCCCBB.exe"	2026-08-16_e000207d72991bd518bc4c82520656c2_elex_glassworm_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CBABCCBBBCBCBAAACABABAACCACCCBACACCABABBAABBBBAABCACCAAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBBCCBBCBAACACCCBBACBBACAACCCCAABCAABCABCAABCBABBABBCAA.exe"	svchost_AACBBAABBBCCAACCBCAABAAACABBCBBBACCCBBCCBABCBACBBCCCCBB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
60	sc.exe
976	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4112	cmd.exe
2440	cmd.exe
4072	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBBCCBBCBAACACCCBBACBBACAACCCCAABCAABCABCAABCBABBABBCAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-16_e000207d72991bd518bc4c82520656c2_elex_glassworm_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AACBBAABBBCCAACCBCAABAAACABBCBBBACCCBBCCBABCBACBBCCCCBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
704	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5104	2026-08-16_e000207d72991bd518bc4c82520656c2_elex_glassworm_icedid_njrat_vidar.exe
5104	2026-08-16_e000207d72991bd518bc4c82520656c2_elex_glassworm_icedid_njrat_vidar.exe
5104	2026-08-16_e000207d72991bd518bc4c82520656c2_elex_glassworm_icedid_njrat_vidar.exe
5104	2026-08-16_e000207d72991bd518bc4c82520656c2_elex_glassworm_icedid_njrat_vidar.exe
4744	svchost_AACBBAABBBCCAACCBCAABAAACABBCBBBACCCBBCCBABCBACBBCCCCBB.exe
4744	svchost_AACBBAABBBCCAACCBCAABAAACABBCBBBACCCBBCCBABCBACBBCCCCBB.exe
4744	svchost_AACBBAABBBCCAACCBCAABAAACABBCBBBACCCBBCCBABCBACBBCCCCBB.exe
4744	svchost_AACBBAABBBCCAACCBCAABAAACABBCBBBACCCBBCCBABCBACBBCCCCBB.exe
4000	svchost_CBBCCBBCBAACACCCBBACBBACAACCCCAABCAABCABCAABCBABBABBCAA.exe
4000	svchost_CBBCCBBCBAACACCCBBACBBACAACCCCAABCAABCABCAABCBABBABBCAA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5104	2026-08-16_e000207d72991bd518bc4c82520656c2_elex_glassworm_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	4744	svchost_AACBBAABBBCCAACCBCAABAAACABBCBBBACCCBBCCBABCBACBBCCCCBB.exe
Token: SeDebugPrivilege	4000	svchost_CBBCCBBCBAACACCCBBACBBACAACCCCAABCAABCABCAABCBABBABBCAA.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1556	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5104 wrote to memory of 4112	5104	2026-08-16_e000207d72991bd518bc4c82520656c2_elex_glassworm_icedid_njrat_vidar.exe	98
PID 4112 wrote to memory of 704	4112	cmd.exe	100
PID 4744 wrote to memory of 3460	4744	svchost_AACBBAABBBCCAACCBCAABAAACABBCBBBACCCBBCCBABCBACBBCCCCBB.exe	103
PID 3460 wrote to memory of 760	3460	notepad.exe	104
PID 5104 wrote to memory of 2440	5104	2026-08-16_e000207d72991bd518bc4c82520656c2_elex_glassworm_icedid_njrat_vidar.exe	108
PID 2440 wrote to memory of 60	2440	cmd.exe	110
PID 5104 wrote to memory of 4072	5104	2026-08-16_e000207d72991bd518bc4c82520656c2_elex_glassworm_icedid_njrat_vidar.exe	111
PID 4072 wrote to memory of 976	4072	cmd.exe	113

C:\Users\Admin\AppData\Local\Temp\2026-08-16_e000207d72991bd518bc4c82520656c2_elex_glassworm_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_e000207d72991bd518bc4c82520656c2_elex_glassworm_icedid_njrat_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5104
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCACCCACBCAACCACBBCCBBBCCABCCACBCCAABACBCBCCBCBACBCAACACCBBCAACABBACBBCABBABACABBBACAACCCAABBABAABBBBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBBAABBBCCAACCBCAABAAACABBCBBBACCCBBCCBABCBACBBCCCCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4112
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCACCCACBCAACCACBBCCBBBCCABCCACBCCAABACBCBCCBCBACBCAACACCBBCAACABBACBBCABBABACABBBACAACCCAABBABAABBBBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBBAABBBCCAACCBCAABAAACABBCBBBACCCBBCCBABCBACBBCCCCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:704
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AABACBCCBABCACABCBCBCCCABAABBAABACBACBBCBABACABCCAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBBAABBBCCAACCBCAABAAACABBCBBBACCCBBCCBABCBACBBCCCCBB.exe" start= auto displayName= "UserDataSvc_AABACBCCBABCACABCBCBCCCABAABBAABACBACBBCBABACABCCAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2440
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AABACBCCBABCACABCBCBCCCABAABBAABACBACBBCBABACABCCAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBBAABBBCCAACCBCAABAAACABBCBBBACCCBBCCBABCBACBBCCCCBB.exe" start= auto displayName= "UserDataSvc_AABACBCCBABCACABCBCBCCCABAABBAABACBACBBCBABACABCCAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:60
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AABACBCCBABCACABCBCBCCCABAABBAABACBACBBCBABACABCCAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4072
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AABACBCCBABCACABCBCBCCCABAABBAABACBACBBCBABACABCCAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:976

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBBAABBBCCAACCBCAABAAACABBCBBBACCCBBCCBABCBACBBCCCCBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBBAABBBCCAACCBCAABAAACABBCBBBACCCBBCCBABCBACBBCCCCBB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4744
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3460
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:760

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:1556

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCCBBCBAACACCCBBACBBACAACCCCAABCAABCABCAABCBABBABBCAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCCBBCBAACACCCBBACBBACAACCCCAABCAABCABCAABCBABBABBCAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4000

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBBAABBBCCAACCBCAABAAACABBCBBBACCCBBCCBABCBACBBCCCCBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBBAABBBCCAACCBCAABAAACABBCBBBACCCBBCCBABCBACBBCCCCBB.exe
1⤵
- Executes dropped EXE
PID:624

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 acf1fe9387bb23b6daf5de5ad8110db81ea037514d82d56f8f3882a73c471436
MD5 4ef9783d4380d30b8372669defd41575
SHA1 bee8f6112db67d3b3dc637b1db03798d7f5ee6a3
SHA512 63fa8d120631dbd9c583bb9665e371df4e9205841d2917da1e3f8ad8550cdaa6b11d71662ec10d536516aea0f395ac67c0831675eacac0854a1a655684330932
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 daee114f50223f0be52d98ea0e724bc796fff54e01bef8520135ecf4a52ccfec
MD5 fb583765d8e5e4266053eb33c1c6cdb2
SHA1 19cf855263d2c2f87aefab0def245f259ee7e0d9
SHA512 a3cc5e37973a38d8a170a745e5c1a3dca227abe80612e5f57b33100c63d59804c66a0fa4c6c8ef84954beed6ee8d57d4789694f37c2673171244e33932f88980
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b075515625b9b0f2ddf6edfe32b2f8399e78fc54c7dd13d61f0ec23664e28930
MD5 d4d79ac78aaf1c67dcf362411320431a
SHA1 6faffea12a4f2ceef2a89f4c63e3723a4eae04ba
SHA512 8e89a56c36b53d8324fbf7c5fec114bf636cda480f12b16edcc33d4a2936569a5f071faacd6f5a76f483a3580b53e1111b210452cf079d4c2d1112a6f7470447
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 102e9846edd6a5ddd6dcab5e8130d5657c2dc6b769ad2e294dfe8b4211a61428
MD5 db687c8ba2de245a111d7a300e0aca9e
SHA1 54221fd4da16cce398ab947af6bc41609de11ac5
SHA512 4bd54812339f6865abec9ad67ee0b2f96d8a9862b0547911ce7c39effc43c26522de5abcb1aa2a71416065848425163e7bc0542e5a8a18bded4987c6ffe7782c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f8033598403c4e81821b810db56fe679ffec184ef1de31f1e1ca957ce8db1640
MD5 77cd4e99b8209dadac3d70a2ce4c1f26
SHA1 a31a46d491181b817be6a24cfca2b9519fd82c06
SHA512 025f4580048b353efd55b2690cfc3b68aaca4671af1eb20905b02315da217d204c86bd72fdafe79ef8351a5b5fb6957aff2f1c86b4804e02dfa2d7470c09c906
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 c4a3e8a874dd7bfa415e37df156d5a0820051642eb24486637a10c546b992219
MD5 4bf0f6470cb2aad6bd10f87ce2fc6fa1
SHA1 cbbc28a82e0016c9ef6da8f7db1b071f67287991
SHA512 a18335e974362d8242b1b74f2e42e50fd2bb772c984100ade4e43242373008f3ee9711fbc25140fed091f1c22598594be2b1b1320f32aa7644a54202581ba0f0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 baacb7781133d3fb391542e02535466095173ce93609f80e65d799875bf9ece0
MD5 0bc7f635df4c0a08680893aa2809bfbf
SHA1 360b6ef746056f4b6f2aea67ae6d73a109972a59
SHA512 eab6e4261c914f89ff13231def3b38385235c92652fa636c26aeda09864ac73dff60c808c1a77d064527fb8083c5bd749062185b4512c43e9260ed7fe20cd7fe
MD5 SHA1 SHA512

Submit Download

svchost_AACBBAABBBCCAACCBCAABAAACABBCBBBACCCBBCCBABCBACBBCCCCBB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBBAABBBCCAACCBCAABAAACABBCBBBACCCBBCCBABCBACBBCCCCBB.exe
Size 13.6MB
SHA256 ce9f06f11a88f99e70c9f7de6e8fe48cf3302fdad45eb8c44a23aad32cb97674
MD5 e000207d72991bd518bc4c82520656c2
SHA1 49c09a41ae909039e8773ed221cc84b9de6b1d61
SHA512 95d284ae299245dca476e1c8486e13dd880907f12f50b45e7edfea56c5f27e3fde04fcaef3bafbf4ef916a93f9c72f24b8d104fb91d9bd09d4b46dd0fe269e2e
SSDEEP 98304:teee6KRuy5a4eee6KRuy5aZ1MbQ9yDAD7KjjqkusjmqMhs:RqNqW1tIDewjqkjiqMS
TLSH
T19CE69E29E6E540F5F9BB9434896BC276E97279210632878FC6D0C63EAF336815D38731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 589456d7fc0f3cc2f79d23cac079fe1cd593922f90e4c246b7c92437608e5750
MD5 0405ec5e5a7a2bd73fd52df263fa754f
SHA1 59f643f9b0fee4f394d6ba2546de24a6f7841b6f
SHA512 f9b44115d87e41939531ee43453ee7b25bd063a7bfebe860bc1e4c862595f9be1a3556d4731e9888299a7fdfe4e8faf628611bb39e2bd1885bcc0a87b7ccc2e2
TLSH
T11711CBA0D4E6E823F8326CCB532DDFC708A567CFAC5C5A9413098218E7D5C321E264E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3460-78-0x0000000005440000-0x0000000005441000-memory.dmp

Download

memory/4000-107-0x00000000006C0000-0x00000000006E1000-memory.dmp

Download

memory/4744-32-0x0000000000890000-0x00000000008B1000-memory.dmp

Download

memory/4744-76-0x0000000000890000-0x00000000008B1000-memory.dmp

Download

memory/4744-52-0x0000000000890000-0x00000000008B1000-memory.dmp

Download

memory/5104-75-0x0000000000870000-0x0000000000891000-memory.dmp

Download

memory/5104-51-0x0000000000870000-0x0000000000891000-memory.dmp

Download

memory/5104-0-0x0000000000870000-0x0000000000891000-memory.dmp

Download

memory/5104-25-0x0000000000870000-0x0000000000891000-memory.dmp

Download

memory/5104-12-0x0000000000870000-0x0000000000891000-memory.dmp

Download